Defence supply chain · CSM v4 · Def Stan 05-138
Cyber security for MOD suppliers: the complete guide
What the Ministry of Defence’s Cyber Security Model v4 now asks of primes and subcontractors: the four Cyber Risk Profiles, the 144 controls of Def Stan 05-138 Issue 4, Cyber Essentials Plus, the Supplier Assurance Questionnaire, Defence Cyber Certification and DEFCON 658 flow-down, in plain English.
At a glance
What is new
What changed with CSM v4
The biggest change is one of focus. Earlier versions of the Cyber Security Model centred on protecting MOD identifiable information. Version 4 moves the focus to your organisation’s overall security and resilience, in support of the MOD’s Cyber Resilience Strategy. In practice that means:
- Scope is wider. It is no longer enough to ring-fence the few systems that touch MOD data. Assessors look at the organisation that delivers the contract.
- New levels. Cyber Risk Profiles Level 0 to 3 replace Very Low, Low, Moderate and High. Level 1 and above bring Cyber Essentials Plus and at least 101 controls, so check where your contracts now sit.
- A CAF-shaped standard. Def Stan 05-138 Issue 4 is organised around the same four objectives as the NCSC Cyber Assessment Framework: managing risk, protecting against attack, detecting events and minimising impact. Work you do here also helps with NHS, government and critical infrastructure customers.
- Certification as evidence. Defence Cyber Certification, delivered through IASME since 2025, is now accepted as evidence of meeting the controls.
Step by step
How the process works
| Step | Who | What happens |
|---|---|---|
| 1. Risk Assessment | MOD delivery team | The contract is assessed and given a Cyber Risk Profile (Level 0 to 3) and a Risk Assessment Reference. You should see both in the tender or contract. |
| 2. Supplier Assurance Questionnaire | You | You answer the questionnaire for that profile through the Supplier Cyber Protection Service, stating which controls you meet. |
| 3. Supplier assurance | The service | Your answers are scored automatically to show whether you comply with the profile. |
| 4. Cyber Improvement Plan | You | If you do not meet every control, you submit a plan committing to close the gaps, with dates. |
| 5. Award and maintenance | Both | The contract proceeds on the basis of your compliance or plan. You renew the questionnaire every year and deliver what your plan promised. |
The questionnaire is a declaration. If you tick a control, you should be able to evidence it the day a prime, the MOD or an auditor asks. Treat it with the care you would give a contractual warranty, because in effect it is one.
The four levels
The four Cyber Risk Profiles
| Profile | Def Stan 05-138 controls | Certification | What it means in practice |
|---|---|---|---|
| Level 0 “Basic” | 3 | Cyber Essentials | Good basic hygiene and an honest questionnaire. Within reach of almost any small firm. |
| Level 1 “Foundational” | 101 | Cyber Essentials Plus | A real step up: governance, risk management, asset and supplier management, access control, logging, incident response and recovery, all evidenced. Where many small and medium suppliers find the step hardest. |
| Level 2 “Advanced” | 139 | Cyber Essentials Plus | Mature, monitored security with stronger detection and resilience. Usually needs dedicated security resource, in-house or contracted. |
| Level 3 “Expert” | 144 | Cyber Essentials Plus | The full standard, for the highest-risk contracts. |
The jump from Level 0 to Level 1 is the one that catches people out: from 3 controls to 101. If your prime has told you a contract is now Level 1, start early. Cyber Essentials Plus alone involves an independent technical audit, and the other controls need evidence that takes time to build. Our Cyber Essentials page explains the scheme.
The standard
Inside Def Stan 05-138 Issue 4
The controls are grouped under four objectives. Here is what each typically asks of a supplier at Level 1 and above, and the evidence to have ready.
A. Managing security risk
Board-level ownership of cyber risk; named roles; a risk management process that covers the contract; an asset inventory; and management of your own suppliers. Evidence: board minutes, role descriptions, a risk register, an asset list, supplier security requirements and reviews.
B. Protecting against cyber attack
Security policies that are followed; identity and access control, including multi-factor authentication and privileged account management; data protection in storage and transit; secure configuration and patching; resilient systems and tested backups; and staff training. Evidence: MFA and patch reports, access reviews, backup restore tests, training records.
C. Detecting cyber security events
Logging and monitoring of the systems that matter, with alerts that someone looks at; at higher levels, proactive discovery of threats. Evidence: log sources, alerting rules, monitoring service contract, triage records.
D. Minimising the impact of incidents
An incident response plan, the capability to act on it, rehearsals, and lessons learned. Evidence: plan, contact lists held offline, exercise reports, post-incident reviews.
Always work from the control text in Def Stan 05-138 for your profile. The standard, not this summary, is what your questionnaire answers are measured against.
Certification
Defence Cyber Certification
Defence Cyber Certification (DCC) is an independent certification against the Def Stan 05-138 controls, delivered through IASME since 2025. Industry Security Notice 2026/02 (30 March 2026) confirms the MOD accepts DCC as assurance that controls are met under DEFCON 658, and that a higher DCC level also covers the lower ones.
- It does not replace the questionnaire. The MOD’s guidance is that certified suppliers still complete the full Supplier Assurance Questionnaire, although it hopes to introduce exemptions.
- It is persuasive with primes. A certificate from an independent body carries more weight than a self-declaration.
- Get ready before you book. Certification is a test of what already exists. A readiness review first saves failed audits and fees.
UK Cyber-Safe is not a certification body and does not issue Cyber Essentials or DCC certificates. We prepare you for them and independently assess where you stand. That separation is deliberate.
Supply chain
DEFCON 658 and your subcontractors
DEFCON 658 is the contract condition that carries the Cyber Security Model. It requires you to flow the cyber requirements down to your own subcontractors. For primes and tier 1 suppliers, that raises three practical questions:
- Do you know which subcontractors are in scope, and at what profile? A subcontractor handling part of a Level 1 contract may need to meet Level 1 controls themselves.
- Is the requirement in their contracts, not just in yours?
- How do you know they comply? A spreadsheet of self-declarations is weak evidence if one of them is breached.
Small subcontractors are often the easiest way into a prime, and attackers know it. Helping them reach the right level is supply chain security, not a favour.
From experience
Where suppliers come unstuck
- Finding out the profile late. The level is set in the Risk Assessment. Ask for it at bid stage, not at contract signature.
- Cyber Essentials Plus scope too narrow. A certificate covering one office network does not cover the contract if the work is done elsewhere or in the cloud.
- Ticking controls you cannot evidence. The questionnaire is a declaration you may have to stand behind.
- Improvement plans nobody delivers. A plan is a commitment. Missing it harms the next renewal and your standing with the prime.
- Forgetting the annual renewal. Compliance lapses quietly if nobody owns the date.
- Ignoring flow-down. The weakest subcontractor becomes your problem.
- Treating it as IT’s job. Level 1 and above include governance controls that only directors can satisfy.
Getting there
A 90-day plan to move from Level 0 to Level 1
| When | Focus |
|---|---|
| Days 1–15 | Confirm the profile and scope with your customer. Name a director as owner. Gap-assess against the Level 1 controls. Book Cyber Essentials Plus for around day 75. |
| Days 16–45 | Close the technical gaps that Cyber Essentials Plus will test: MFA, patching, secure configuration, malware protection, admin accounts. Build the asset list and risk register. |
| Days 46–75 | Policies that are actually followed, supplier requirements, logging and monitoring, backups with a tested restore, incident response plan and a first exercise. Staff training. |
| Days 76–90 | Cyber Essentials Plus audit. Complete the questionnaire honestly. Write a Cyber Improvement Plan for anything outstanding, with owners and dates. |
Ninety days is achievable for a well-run small firm with an engaged director. Larger or more complex organisations usually need longer. Start with the gap assessment and you will know which you are.
Working with us
How we can help
Def Stan 05-138 gap assessment
An independent assessment against every control for your target profile, with the evidence you have, the evidence you need and a prioritised plan.
Fixed price, agreed before we start
Questionnaire and improvement plan
Support to answer the Supplier Assurance Questionnaire accurately and write a Cyber Improvement Plan the MOD and your prime will accept.
Ask about questionnaire support
Fixed price, agreed before we start
Certification readiness
Preparation for Cyber Essentials Plus and Defence Cyber Certification, so the audit confirms what is already there.
Fixed price, agreed before we start
Supply chain flow-down for primes
A structured programme to identify in-scope subcontractors, set their requirements and check their compliance proportionately.
Ask about supply chain assurance
Priced on the number of suppliers
Director briefing and exercise
What the governance controls ask of directors, and a realistic incident rehearsal that evidences the response controls.
Exercises from £2,650 + VAT
Virtual CISO
A named security lead to own the programme, the annual renewal and the improvement plan when you have nobody in post.
Monthly retainer
Independent, and clear about what we are not
We are not a certification body and we do not sell the products that would close your gaps. We tell you where you stand and what to do about it.
FAQ
Questions we are asked
How do I find out my Cyber Risk Profile?
It is set by the MOD delivery team’s Risk Assessment and comes with a Risk Assessment Reference. Your contracting authority or prime should give you both. Ask at bid stage.
Do I need Cyber Essentials Plus?
Cyber Essentials is required at every level. Cyber Essentials Plus is required from Level 1 upwards under Def Stan 05-138 Issue 4. Its scope must cover all aspects of the contract.
Does Defence Cyber Certification replace the questionnaire?
Not at present. The MOD accepts DCC as evidence under DEFCON 658, but certified suppliers still complete the full Supplier Assurance Questionnaire.
What if we cannot meet every control?
You submit a Cyber Improvement Plan committing to close the gaps with dates. Deliver it: the questionnaire is renewed every year.
Do my subcontractors have to comply?
DEFCON 658 requires you to flow the requirements down. Subcontractors working on the contract need to meet the controls appropriate to what they do.
Who do we contact at the MOD?
The Supplier Cyber Protection Service helpdesk, whose contact details are on the MOD’s Cyber Security Model guidance page.
Sources
Primary sources
- Cyber Security Model (MOD, updated 6 March 2026)
- Def Stan 05-138 Issue 4: cyber security for defence suppliers (MOD, 14 May 2024)
- ISN 2026/02: Defence Cyber Certification under DEFCON 658 (MOD, 30 March 2026)
- DEFCON 658: cyber flow-down (MOD)
- Supplier Cyber Protection Service: questionnaire workflow (MOD)
- Cyber Essentials (NCSC)